There is a only one file named change.log whose name won't be changed. When my environment changes, I always take this log and append in change.log by script, but Splunk always indexes the new records which I append. How can I get splunk to index the whole content every time change.log updates?
You can use crcSalt inside inputs.conf
http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf
Example:
[monitor:///opt/splunk/etc/apps/YOURAPP/samples/*]
...
crcSalt = <SOURCE>
...